LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23064: net/sched: act_ife: avoid possible NULL deref

In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ife: avoid possible NULL deref tcf_ife_encode() must make sure ife_encode() does not return NULL. syzbot reported: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:ife_tlv_meta_encode+0x41/0xa0 net/ife/ife.c:166 CPU: 3 UID: 0 PID: 8990 Comm: syz.0.696 Not tainted syzkaller #0 PREEMPT(full) Call Trace: <TASK> ife_encode_meta_u32+0x153/0x180 net/sched/act_ife.c:101 tcf_ife_encode net/sched/act_ife.c:841 [inline] tcf_ife_act+0x1022/0x1de0 net/sched/act_ife.c:877 tc_act include/net/tc_wrapper.h:130 [inline] tcf_action_exec+0x1c0/0xa20 net/sched/act_api.c:1152 tcf_exts_exec include/net/pkt_cls.h:349 [inline] mall_classify+0x1a0/0x2a0 net/sched/cls_matchall.c:42 tc_classify include/net/tc_wrapper.h:197 [inline] __tcf_classify net/sched/cls_api.c:1764 [inline] tcf_classify+0x7f2/0x1380 net/sched/cls_api.c:1860 multiq_classify net/sched/sch_multiq.c:39 [inline] multiq_enqueue+0xe0/0x510 net/sched/sch_multiq.c:66 dev_qdisc_enqueue+0x45/0x250 net/core/dev.c:4147 __dev_xmit_skb net/core/dev.c:4262 [inline] __dev_queue_xmit+0x2998/0x46c0 net/core/dev.c:4798

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel crash bug in traffic-control IFE handling. A missing NULL check can trigger a kernel oops when the act_ife encode path receives an unexpected NULL result. The public record does not provide CVSS, confirmed exploitation, or remote attack details.

Executive priority

Treat as a normal kernel maintenance priority unless affected systems use advanced traffic-control features in sensitive network roles. Escalate patching for appliances, routers, or hosts where a kernel crash would cause service interruption.

Technical view

The flaw is in net/sched act_ife. tcf_ife_encode() failed to ensure ife_encode() returned a non-NULL value before metadata encoding, leading to a NULL pointer dereference reported by syzbot/KASAN in ife_tlv_meta_encode.

Likely exposure

Likely limited to systems running affected Linux kernels with traffic-control act_ife functionality present or configured. The source bundle does not state whether exploitation is remote, local, privileged, or configuration-dependent.

Exploitation context

No active exploitation is cited, and KEV status is false. The available evidence is a syzbot crash report and Linux stable fixes, indicating reliability impact rather than confirmed real-world abuse.

Researcher notes

The trace shows syzbot triggered a KASAN NULL pointer dereference through tcf_ife_act and cls_matchall enqueue processing. Public data does not establish attacker prerequisites, namespace requirements, impact beyond crash, or exploitability beyond denial-of-service style failure.

Mitigation direction

  • Update affected Linux kernels to releases containing the referenced stable fixes.
  • Use distribution vendor kernel advisories to confirm backported fix availability.
  • Prioritize internet-facing or network-appliance Linux systems using traffic control.
  • Check vendor guidance before relying on any temporary workaround.

Validation and detection

  • Inventory Linux kernel versions against the affected version list.
  • Review kernel package changelogs for the referenced stable commit fixes.
  • Identify systems using traffic-control IFE or act_ife features.
  • Confirm patched kernels boot and networking regression tests pass.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23064 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
8Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux295a6e06d21e1f469c9f38b00125a13b60ad4e7c, 295a6e06d21e1f469c9f38b00125a13b60ad4e7c, 295a6e06d21e1f469c9f38b00125a13b60ad4e7c, 295a6e06d21e1f469c9f38b00125a13b60ad4e7c, 295a6e06d21e1f469c9f38b00125a13b60ad4e7c, 295a6e06d21e1f469c9f38b00125a13b60ad4e7c, 295a6e06d21e1f469c9f38b00125a13b60ad4e7cunaffected
LinuxLinux4.11, 0, 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.68, 6.18.8, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.